A manager sets up ongoing monitoring of the security programme itself. Which two questions does NIST say that monitoring should answer? Choose two.

Answer: A. Are security activities still providing appropriate support to the mission?
C. Are controls accomplishing their intended purpose?

NIST says programme monitoring should confirm that ongoing activities support the mission, that policies and procedures are current and aligned with evolving technology, and that controls are accomplishing their intended purpose.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.6 Ongoing Monitoring